Overview

overview

10

Static

static

10

cc6bca67fc...9c.exe

windows10-2004-x64

10

cc6bca67fc...9c.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cc6bca67fc61eb4fd0e9d8e6cbf058f4f21aff8ae0824fc5557c77cad626039c
  • Size 34.8MB
  • Sample260719-3trmwsbw8t
  • SHA256 cc6bca67fc61eb4fd0e9d8e6cbf058f4f21aff8ae0824fc5557c77cad626039c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
redlinesvcstealerfffdiscoverydownloaderinfostealerinstallerpersistencepyinstallerstealerupx

Malware Config

Extracted

Family

  • svcstealer

C2

  • http://62.60.226.159/zbuyowgn/data.php

  • http://196.251.107.130/zbuyowgn/data.php

  • http://196.251.107.23/diamo/data.php

  • http://178.16.53.7/diamo/data.php

  • http://158.94.208.102/diamo/data.php

  • http://196.251.107.61/diamo/data.php

Attributes
  • bot_urls

    http://196.251.107.23/bot64.dll

  • build_id

    16/02/2026

  • srv_delay

    1

  • srv_retry

    1

Extracted

Family

  • redline

Botnet

  • fff

C2

  • 196.251.107.104:1912

Targets

    • Target
      cc6bca67fc61eb4fd0e9d8e6cbf058f4f21aff8ae0824fc5557c77cad626039c
    • Size 34.8MB
    • SHA256 cc6bca67fc61eb4fd0e9d8e6cbf058f4f21aff8ae0824fc5557c77cad626039c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    fffdiscoverydownloaderredlinesvcstealerinfostealerinstallerpersistencepyinstallerstealerupx

    • Family: RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Family: SvcStealer, Diamotrix

      SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

      stealerdownloadersvcstealer

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks